Fake Indeed Interview Apps Deliver Android Spyware to Job Seekers

Scammers are exploiting the competitive job market by using fake Android "interview" applications on the popular employment platform Indeed to target unsuspecting job seekers. These malicious apps, disguised as legitimate tools for conducting interviews, are designed to trick users into granting them extensive permissions, ultimately leading to the installation of spyware on their devices.

Reports from users in the UK and Brazil, as well as discussions on Reddit, highlight a common tactic: job seekers are instructed by supposed employers on Indeed to download and install an APK file, often named "MyInterview" or similar, to proceed with the application process. These instructions are frequently framed as necessary steps for "completing the interview," "updating the Indeed application," or "identity verification."

Analysis by Malwarebytes has revealed that these fake apps impersonate Indeed's login page. After a user enters their credentials, the app establishes a VPN connection. While VPNs are legitimate tools, their immediate use in this context is a significant red flag. This VPN connection can grant the malicious app substantial control over the device's network traffic, potentially allowing attackers to route communications through their own systems, conceal their activities, or facilitate further stages of an attack.

The primary payload identified in these campaigns is spyware, though the apps are classified as Trojan droppers, capable of installing additional malicious software. Once the spyware gains Accessibility permissions, it effectively takes control of the device. A particularly concerning feature is its ability to prevent uninstallation; when a user attempts to remove the app through Android settings, the malware can force the screen back, thwarting removal efforts.

Indeed has confirmed that its official Android app is distributed solely through the Google Play Store and that its interview process occurs entirely within a browser, never requiring the download of a separate application. The company strongly advises job seekers to avoid clicking links or downloading files from suspicious messages.

The deceptive nature of these apps lies in their ability to bypass user caution through a seemingly legitimate pretext. Even if the initial fake app doesn't directly steal data, it serves as a potent delivery mechanism for more dangerous malware. The presence of the app within Android's Accessibility services is also a major concern, as these services are designed to assist users with disabilities but can be abused to view screen content and perform actions on behalf of the user.

To stay safe, job seekers should be wary of any requests to sideload Android apps, enable VPN connections, or install software from unknown sources outside of official app stores. It is crucial to verify job offers through independent channels and be suspicious of any process that deviates from the standard hiring procedures of reputable platforms like Indeed.

Indeed has stated that it is aware of these scams and condemns the exploitation of job seekers' trust. They encourage users to visit their Help Center for guidance on identifying legitimate Indeed applications and spotting warning signs of fake ones.